Nice tool collection in the VMDK handbook. I'm looking for a way to list included sectors in a sparse / delta VMDK file, so I can use an MS tool in the guest to list affected NTFS files in a given snapshot for malware analysis.. Is there a tool to list modified sectors in a delta VMDK file?

Yes, I use change trackers in the guest for this, but unfortunately they can't catch everything somehow.